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Abstract 

We show how to convert a quantum stabilizer code to a one-way or two- 
way entanglement distillation protocol. The proposed conversion method 
is a generalization of those of Shor-Preskill and Nielsen-Chuang. The 
recurrence protocol and the quantum privacy amplification protocol are 
equivalent to the protocols converted from [[2, 1]] stabilizer codes. We also 
give an example of a two-way protocol converted from a stabilizer bet- 
ter than the recurrence protocol and the quantum privacy amplification 
protocol. The distillable entanglement by the class of one-way protocols 
converted from stabilizer codes for a certain class of states is equal to or 
greater than the achievable rate of stabilizer codes over the channel cor- 
responding to the distilled state, and they can distill asymptotically more 
entanglement from a very noisy Werner state than the hashing protocol. 



1 Introduction 

In many applications of quantum mechanics to communication, the sender and 
the receiver have to share a maximally entangled quantum state of two particles. 
When there is a noiseless quantum communication channel, the sender can send 
one of two particles in a maximally entangled state to the receiver and sharing 
of it is easily accomplished. However, the quantum communication channel 
is usually noisy, that is, the quantum state of the received particle changes 
probabilistically from the original state of a particle. 

Entanglement distillation protocols and quantum error-correcting codes 
[161 118j are the schemes for sharing a maximally entangled state over a noisy 
communication channel. A distillation protocol is said to be two-way (resp. 

* One page abstract of this paper will appear in the Proceedings of 2003 IEEE International 
Symposium on Information Theory. 
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one-way) if it involves two-way (resp. one-way) classical communication. Two- 
way protocols have larger distillation ability than one-way protocols. However, 
few two-way protocols has been proposed so far, namely the recurrence protocol 
|2] and the quantum privacy amplification protocol (QPA protocol) [B]. There 
may be many two-way protocols better than existing ones, and the discovery of 
better protocols has been awaited. 

Immediately after the proposal of those schemes, Bennett et al. discovered 
that one can construct a one-way entanglement distillation protocol from a 
quantum code Section V.C], which requires 2n additional qubits where n is 
the number of noisy entangled states to be distilled. Nielsen and Chuang |12l 
Exercise 12.34] observed a construction method of a one-way protocol without 
extra qubits from a real binary quantum stabilizer code as a generalization of 
the idea in |T7|. 

By a conversion method from a quantum code to a distillation protocol, we 
can solve problems of distillation protocols from results in quantum codes. For 
example, we can construct a good distillation protocol from a good quantum 
code. Thus such a conversion method deserves further investigation. 

It is not known how one can convert a quantum error-correcting code to 
a two-way entanglement distillation protocol. We shall propose a conversion 
method from an arbitrary quantum stabilizer code to both one-way and two- 
way entanglement distillation protocols as a generalization of Shor, Preskill 17 , 
Nielsen, and Chuang Benefits of the proposed conversion methods are 

• We can construct infinitely many two-way protocols. One can easily con- 
struct a two-way protocol better than the recurrence protocol and the 
QPA protocol from a simple stabilizer code (see Section ll~2l . 

• It is known that one-way protocols and quantum error-correcting codes 
without classical communication have the same ability for sharing max- 
imally entangle states over a noisy quantum channel 0. The proposed 
protocols might be used for further clarification of the relation between 
distillation protocols and quantum error-correcting codes. 

This paper is organized as follows: In Sectional basic notation is introduced. 
In Section [3] we present a construction of entanglement distillation protocols 
from quantum stabilizer codes. In Section we give examples of converted 
protocols equivalent to the recurrence protocol and the QPA protocol, and an 
example better than them. In Sectional we evaluate the distillable entanglement 
by the class of one-way protocols converted from stabilizer codes, and show 
that the converted protocols can distill asymptotically more entanglement from 
a noisy Werner state than the hashing protocol In Section HJ1 we derive a 
lower bound on fidelity with a general initial state of protocols. 

2 Notation 

In this section we fix notation and the problem formulation. Let Ha and 
Hb be p-dimensional complex linear spaces with orthonormal bases {|0a), • ■ ■ , 
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\{p — and {|0_b), . . . , |(p— respectively, where p is a prime number. 

We shall restrict ourselves to p-ary stabilizer codes because an m-ary stabi- 
lizer code can be constructed as a tensor product of p;-ary stabilizer codes ^] 
p. 1831, Remarks], where pi are prime divisors of m, and extension of the pro- 
posed conversion method to the m-ary case is straightforward. We define the 
maximally entangled states in Ha <8> Hb by 

1 

\0(a,b)) =I®X a Z b — J2\*Ai B } 

where a, b E {0, . . . , p — 1}, and matrices X and Z are defined by 

X |i) = \i + 1 mod p), = 

with a complex primitive p-th root ix> of 1. The matrices X, Z and their commu- 
tation relation were first applied to the quantum mechanics by Wcyl 20 , Section 
4.15]. Suppose that Charlie prepares n pairs of particles in the state |/3(0,0)), 
sends the particles corresponding to Ha to Alice, and sends the other particles 
corresponding to Hb to Bob. The quantum channels between Alice and Charlie 
and between Bob and Charlie are noisy in general, and Alice and Bob share a 
mixed state p G S(Hf n <g) iff"), where S{Hf n <8> iff") is the set of density 
operators on H® n ® if®". The state p can be an arbitrary density operator. 
The goal of an entanglement distillation protocol is to extract as many pairs of 
particles with state close to |/3(0, 0)) as possible from n pairs of particles in the 
state p. 

3 Protocol 

In this section we shall describe how to make an entanglement distillation 
protocol from a quantum stabilizer code. In the protocol we extract a state 
r e S(Hf k H% k ) from p e S(H® n ® ff| n ). 

The proposed protocol will be constructed from the nonbinary generalization 
IT4*j of quantum stabilizer codes 0] G3 Ej • We assume that the reader is 
familiar with the formalism of the nonbinary stabilizer code. Let us introduce 
notation of stabilizer codes. Let E = {cu 1 X ai Z bl gj • • • ® X a "Z b ™ : ai, bi, . . . , 
a n , b n , i are integers }, and S a commutative subgroup of E. The subgroup S 
is called a stabilizer. 

Let Z p = {0, . . . , p — 1} with addition and multiplication taken modulo p. 
For a vector a = {at, &i, . . . , a„, 6„) G Z^™, let 

XZ(a) = X ai Z bl ® • • • (g) A Q " Z fc " . 

Suppose that {XZ(gi), . . . , XZ(.g„_fc) (and possibly some power of w/) } is a 
generating set of the group S, where g\, . . . , g n --k are linearly independent over 
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Let H be a complex linear space with the orthonormal basis {|0), . . . , \p— 1)}, 
and hereafter we shall identify H with Ha and Hb by linear maps |i) i— > \%a) and 
\i) l— » Ks)- Let Q be a stabilizer code defined by S 1 , that is, a joint eigenspace 
of 5 in H® n . There are many joint eigenspaces of S and we can distinguish an 
eigenspace by its eigenvalue of XZ(^) for % = 1, . . . , n — k. Hereafter we fix 
a joint eigenspace Q of S and suppose that Q belongs to the eigenvalue Aj of 
XZ(gi) for i = 1, . . . , n — k. 

Suppose that we sent G Q, and received XZ(e)\ip). Wc can tell which 
eigenspace of S contains the state XZ(e)\ip) by measuring an observable whose 
eigenspaces are the same as those of XZ(gi). Then the measurement outcome 
always indicates that the measured state XZ(e)\cp) belonging to the eigenspace 
\ iUJ (9i,e> ^ where (gi,e) is the symplectic inner product defined by 



for Qi = (ai, &i, . . . , a n , b n ) and e = (ci, di, . . . , c„, d„). 

Wc define = (ai, — &i, . . . , a„, —b n ). Since the complex conjugate of u) 
is we can see that XZ(g*) is a componentwise complex conjugated matrix 
of XZ{gi). Let 5* be a subgroup of £ generated by {XZ(^), . . . , XZ(g*_ k )}. 
Easy computation shows that S* is again commutative. So we can consider joint 
eigenspaces of S*. There exists a joint eigenspace Q* of S* whose eigenvalue of 
XZ{g*) is A, (the complex conjugate of \). 

With those notation, our protocol is executed as follows: 

1. Alice measures an observable corresponding to XZ(g*) for each i, and let 
\iUJ~ ai be the eigenvalue of an eigenspace of S* containing the state after 
measurement. In what follows we refer to (oi, . . . , a n -k) € Zp~ fc as a 
measurement outcome. 

2. Bob measures an observable corresponding to XZ(^) for each i, and let 
XiUj bi be the eigenvalue of an eigenspace of S containing the state after 
measurement. In what follows we also refer to (pi, . . . , &„_k) € Z™ _fe as 
a measurement outcome. 

3. Alice sends (ai, . . . , a„_fc) to Bob. 

4. Bob perform the error correction process according to 6i — ai, . . . , — 
a„_fe as described below. 

5. Alice and Bob apply the inverse of encoding operators of the quantum 
stabilizer codes. 

6. Alice and Bob discards the last n — k particles. 

7. If the difference of the measurement outcomes (bi — ai, . . . , b n -k — a n -k) 
indicates that the fidelity between the remaining k particles and \(3(0, 0))® fe 
is low, Bob discards all of his particles and he tells Alice the disposal of 
particles. 



n 




(1) 
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We shall introduce some notation. For a vector u G Z^™ let 
|/3(t0> = (J®XZ(tO)|/9(0,0)>«". 

Let Q(x) [resp. Q*(x)\ C H® n ~ iff" ~ fff" be the quantum stabilizer code 
of 5 (resp. S*) belonging to the eigenvalue XiUi Xi (resp. \iUj~ Xi ) of XZ(<fi) [resp. 
XZ(g*)] for a vector 2: = (xi, . . . , x n -k) G Z"~ fc , and [resp. -P*(x)] be the 

projection onto Q(x) [resp. Q*(x)]. 



Lemma 1 We /icwe 

{P*(x) ® /} |/3(0)) = {P*(x) <g> P(x)} |/3(0)) 

/or any x G Z™ _fc . 



(2) 



Proof. Let {|0), . . . , |p™ — 1)} be an orthonormal basis of H® n consisting of 
tensor products of {|0), . . . , \p — 1)} C H, and we have 

v^i/3(o)) = x; l*> ® l*>- 

t=0 

For x € Zp~ fc , let {|x, 0), . . . , |x,p fc — 1)} be an orthonormal basis of Q(x). For 

S"fccL"fcC 

| ¥> )= ao |0) + "- + a p »_ 1 |p n -l) eff®", 

we define 

p = a |0) + -.. + a p »_i|p B -l) 1 



where is the complex conjugate of a*. With this notation, {\x, 0), 



\x,p 



,n—k 



1)} is an orthonormal basis of Q*(x). The set {|x, i) : x e Z™ , 
i = 0, . . . , p k — 1} is an orthonormal basis of H® n and there exists a unitary ma- 
trix on H® n that transforms the basis {|0), . . . , \p n - 1)} to {\x, i) : x G Z£" fe , 
z = 0, . . . , p k — 1}. Let U be the componentwise complex conjugate of U, that 
is, U transforms j|0), . . . , \p n - 1)} to {\x,i) : x G Z£" fc , i = 0, . . . , p k - 1}. 
We have U <g> U\/3(0)) = |/3(0)) [Ej. Therefore 



/^|/3(0)) 



E E^ 



X,l 



Since 



P k -i 

E (^>*i 

i=0 



we have 

*/p*{P*($) ® 7}|/3(0)) 



E 

i=0 



x,i (at,« 



E E l f ' *) ® l f ' *) 
fezr 1, i=0 
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P k -1 

= y/FiFiZ) ® P{x)}\0)) (3) 

■ 

Suppose that we perform the protocol above to the state \(3(u)) = {I eg) 
XZ(u)}|/3(0)). After we get a — [a±, a n -k) G Zp _fe as a measurement 
outcome in StepQl the state is 

{P*{a) <g> /}{/ ®XZ(tT)}|/3(d)) 
= {/®XZ(u)}{P*(a)®/}|/3(0)) 
= {/®XZ(u)}{P*(a)®P(a)}|/3(0)) [by Eq. ©]. 

Observe that the vector {/ ® XZ(u)}{P*(a) ® P(a)}\(3(0)) belongs to Q*(a) ® 
Q(6), where 

& = a+ ((f)i,u), {g n -k,u))- 

Thus the measurement outcome in Step [21 must be b. 

For the simplicity of presentation, we assume that the state p G S(H® n £g) 
Hg n ) can be written as 

p= a(®\P@))(l3W\, (4) 

where {a (it) : u G Z^™} is a probability distribution. A general case will be 
treated in Section [HI 

After performing Step in the proposed protocol to state l@J and getting 
a G Zp _fc as a measurement outcome, the state is 

a(u){I ® XZ(u)}P(a, a)p(0)P(a, a){7 ® XZ(u)*}, 

where P(a, a) = P*(a) <g> P(a) and p{6) = |/3(0))(/3(0)|. Suppose that we get b 
as a measurement outcome in Step [21 and denote (&i — ai, . . . , b n -k — a>n-k) by 
s. The state {/ <g> XZ(u)}P(a, a)\/3(Q)) belongs to Q*(a) ® Q[a + ((<fi, it), • • • , 
(g n -k, u))]. Thus the state after Step |5] is 

^ a{u)P{a, b){I ® XZ(u)}P(a, a)p(0)P(a, a) {I <g> XZ(u)*}P(a, &) 
tfezf 

^ a(w)P(a,6){/(g)XZ(M)}P(a,a)p(0)P(a,a){/® XZ(u)*}P(a, 6) 

«6_D(s) 

= ^ a(u){7® XZ(u)}P(a,a) /9 (0)P(a,a){/® XZ(u)}, 
where 

D(s) ={«£ Zp" : u) = 6, - aj, for each i}. 
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Let C be the linear subspace of Z^™ spanned by gi, . . . , g n -ki and C 1 - be 
the orthogonal space of C with respect to the symplectic inner product QJ . For 
vectors u, v such that u — v G C, XZ(u) and XZ(tT) has the same effect on states 
in Q(a) for any a, and we can identify errors XZ(w) and XZ(v) if u — v G C, 
which is equivalent to v G u+ C. Thus, among errors XZ(u) corresponding to 
D(s), the most likely error vector u is one having maximum 

veu+c 

in the set D(s). Let e be the most likely error vector in D(s). The set D(s) is 
equal to 

e + C 1 - = {e + u : hgC 1 }. 

Bob applies XZ(e) -1 to his particles. This is Step0J After applying XZ(e)^ 1 
to Bob's particles, the joint state of particles of Alice and Bob is 

a(u){I®XZ(u-^}P(a,a)p(6)P(a,a){I®XZ(u-e)*}. (5) 

u&e+C ± 

Recall that XZ{u — e) does not change a state in Q(a) if it — e e C. Therefore 
the state (j5jl is equal to 

Y a{u)P(a, a)p(6)P(a, a)+ 

uee+C 

^ a{u)[I®XZ{u- e)]P{a,a)p{Q)P{a,a)[I ® XZ(u- e)*]. (6) 

uee+(C ± \C) 

We shall explain how to use an encoding operator in Step |S] to extract 
|/3(0, 0)) <s>fc from the above state. Let |a) £ ij«>™- fe be an ancillary state. Con- 
sider an encoding operator U c on H® n sending \i) (g) |a) G }j® n to \a, i) for 
i = 0, . . . , p k — 1, where {\a, 0), . . . , \a,p k — 1)} is an orthonormal basis of 
Q(a) defined above. Observe that U e is an encoding operator for Q*(a) sending 

|i) <8> | a) G H® n to \a,i) for i = 0, . . . , p k - 1. Applying I^T 1 <X> l/^ 1 to state © 
yields 

53 1 (8 C/" 1 )!/ ® XZ{u - e)]P{a, a)p{6) 

u^e+C ± 

P(a, a)[I <g> XZ(u - e)*] (££ ® CT e ) 
= J! ^(tT 1 ® ^Vfa.aXOlPt^aJ^g t/e) [by Eq. ©] 

+ J! a(u)(C4" 1 ®c/ o " 1 )[/®XZ(u-e)]P(a,a)p(0) 

ffee > +(C- L \C) 

P(a, a) [J ® XZ(u - e)*] (t£ ® J7 ) 
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p -1 



- E 



a, z; (X> |a, z 

i=0 




^ a(u)(C/ e 

u€e+C 
(TT c (g>U c ) [by Eq. ©] 

+ a(u)(T7r 1 ®U- 1 )[I®XZ(ti-e)]P(a,a)p(d) 

u£e+(C ± \C) 

P{a, a) [J ® XZ(S - e)*] (jT e <gs U e ) 



= 4r £ a(u){|/?(0,0))^ fc ®|a)® 2 }{(/3(0,0)|® fe ®(a|® 2 } [by definition of f/ c ] 

+ 51 a(iZ)(t^" 1 ®I/ - 1 )[/®XZ(t?-g)]P(a,3)p(6) 

ue?+(C->-\C) 

P(3, S)[J®XZ(S gitfe) (7) 

Taking partial trace of the first term over the last n — k qubits yields |/3(0, 0))® fe , 
which is SteplHI 

Let T5 be the final state of StepO that is, state Q, and tq be the state after 
StepEI In StepH Bob computes the fidelity between the state |/3(0,0))® fc and 
r 6 by using knowledge of s and {a(u) : u £ Z 2ra }. TV^] is not 1 because r 5 is 
a state after projection. We have 

Tr[r 6 ] = Tr[r 5 ] = Tr [p(5, a)p(0)P(a, a)] ^ a(tZ) 

= (/?(G)|P*(a)® J|/3(0)) £ a(tZ) [by Eq. ©] 



^ ^ a(tO [by Eq. Q] 



v 

uGe+C 1 - 

If the initial state is \/3(u)) such that u G e + C, we can get 
(l/p"- fc )|/3(0,0))® fc (/3(0,0)|® fc as r 6 . Therefore we have 

(/3(0,0)r fe r 6 |/3(0,0))^>-^ J2 a ^ 

P uGe+C 

Thus Bob estimates that the fidelity between |/3(0, 0))® and the normalized 
state of r 6 is at least 

The value ||SJ) varies according to s = (61 — ai, . . . , — a„_fc). If obtained 
difference s implies low fidelity, Bob discards all the particles and tell Alice the 
disposal. 

Note that if we include Step|7|then the whole protocol needs two-way classical 
communication, but if we exclude Step then it needs only one-way classical 
communication. 
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When Alice and Bib do not execute Step[7| the average of fidelity |JS} should 
be considered instead of respective values of Eq. ((SJ) for each difference s of 
measurement outcomes. The average of Eq. (jHJ is at least 

E E a @)> (9) 

where e{s) is the guessed error vector for a given difference s of measurement 
outcomes. This average fidelity © will be studied in Sections 0] and 

4 Examples 

In this section we show how one can construct the well-known recurrence pro- 
tocol and the QPA protocol from stabilizer codes, and give a two-way protocol 
constructed from a stabilizer better than the recurrence protocol and the QPA 
protocol. 

4.1 The recurrence protocol and the QPA protocol 

The recurrence protocol without twirling Step (A2)] has the same effect 
on any density operator on H® 2 ® H^ 2 as the proposed protocol with p = 2, 
n = 2, k = 1, the stabilizer S generated by Z ® Z, encoding operators t/ e (+l) : 
(ao|0) +ai|l))|a) i— > ao|00) +q;i|11) for the code belonging to eigenvalue +1 of 
Z® Z, U e (-1) : (a \0) + ai|l))|a) ^ a \01) + a^lO) for the code belonging to 
eigenvalue —1 of Z<£> Z, and discarding particles in Step0if s = (1) S This 
can be seen by a tedious but straightforward computation. 

The QPA protocol [5] has the same effect as the protocol converted from 
the stabilizer S generated by XZ <g) XZ, encoding operators U c (+1) : (ao|0) + 
ai|l))|a) ^ ao (|0) - »|1))(|0) + + a x (|0) + i|l))(|0) - for the code 
belonging to eigenvalue +1 of XZ(g>XZ, U e (-1) : (a \0) +ai|l))|a) ^ a (\0) - 
i|l))(|0> - + Qi(|0) + i|l))(|0) + for the code belonging to eigenvalue 
— 1 of XZ eg) XZ, and discarding particles in Step [7| if s = (1) € 

4.2 A better protocol 

We shell compare the protocol constructed from the stabilizer generated by 
{X <g)X®X®X,Z®Z®Z®Z} (p = 2) with the recurrence protocol and 
the QPA protocol in a similar way to [21 Fig. 8]. We discard particles in the 
protocol unless the measurement outcomes completely agree, i.e., s = (0,0). 

Encoding operators for the stabilizer codes belonging to the eigenvalue (— l) Sl 
oiX(g>X(g)X(g)X and (-1) S2 of Z ® Z ® Z ® Z are described in TableHJ 

Suppose that we have many copies of noisy entangled state 

F\(3(0, 0))(/3(0, 0)1 + ^^(1/3(0, l))(/3(0, 1)|+|/J(1, 0))(/3(l, 0)| + |/3(1, 1))(/3(1, 1)|), 
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Table 1: Encoding Maps 



eigenvalues 


encoding map 


( Sl ,s 2 ) = (0,0) 




00) 
01) 
10) 
11) 


a > 71 ( 

a ) " 7f( 

a ) ^ 75 ( 
a) i ► A=( 


0000) + 
0011) + 
0101) + 
0110) + 


mi)) 

1100)) 
1010)) 
1001)) 


( Sl ,s 2 ) = (0,1) 




00) 
01) 
10) 

11) 


a ) ^ 71 ( 
a ) " 75 ( 
a ) " 7f ( 
a ) " 73 ( 


0001) + 
0010) + 
0100) + 
1000) + 


1110)) 
1101)) 
1011)) 
0111)) 


( Sl ,s 2 ) = (1,0) 




00) 
01) 
10) 

11} 


a ) ^ 7f ( 
a ) ~ 7i ( 
a ) -> 75 ( 
a ) " 73( 


0000) - 
0011) - 
0101) - 
0110) - 


1111)) 

1100)) 
1010)) 
1001)) 


( Sl ,s 2 ) = (1,1) 




00) 
01) 
10) 

11) 


a) I— ► -4=( 

a ) ~ 75( 
a ) " 71 ( 
a > " 7f( 


0001) - 
0010) - 
0100) - 
1000) - 


1110)) 
1101)) 
1011)) 
0111)) 



and we want to distill the Bell state |/3(0, 0))(/?(0, 0)| as many as possible by 
using the hashing protocol and a two-way protocol chosen from the recurrence 
protocol without twirling, the QPA protocol, and the protocol constructed from 
{X ® X ® X <g) X, Z (g) Z ® Z ® Z}. We use the hashing protocol to distill the 
perfect the Bell state |/3(0, 0)) (/3(0, 0)| after suitable number of iteration of a 
two-way protocol as described in |3J Section III.B.l]. 

The number of perfect Bell state distillable by the three two-way protocols 
are compared in Figure Q Observe that an example of the proposed protocol 
has larger distillable entanglement for the range of F between 0.75 to 0.87. 

5 Distillable entanglement by the converted pro- 
tocols 

In this section, we evaluate the distillable entanglement by one-way protocols 
constructed from stabilizers. Distillable entanglement is the most important 
measure of the performance of a class of protocols. 

We mean by an [[n, k]] entanglement distillation protocol a protocol always 
leaving k pairs of particles out of given n pairs of particles. Let T> be a class of 
[[n, k]] entanglement distillation protocol for n = 1, 2, . . . , and k = 1, . . . , n. Let 
p n be a density operator on H® 2n . The distillable entanglement by the protocol 
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Figure 1: Comparison of two-way protocols 



T> for the sequence of states {p n } is the maximum of a real number R such that 
for any R' < R and any e > there exists an [[n, k)] (k > nR') protocol in T> 
such that the protocol extracts a state r G H® 2k from p n such that the fidelity 
between r and a maximally entangled state in H® k is at least 1 — e. Roughly 
speaking, the distillable entanglement by I? is the largest number of maximally 
entangled pairs in H® 2 distillable from one pair of particles. Our definition 
imposes on protocols the restriction that a protocol always produces the same 
number of pairs of particles. A general definition without this restriction was 
given by Rains |T5) . 

Let {a(i,j) : € Z^} be a probability distribution, and consider the 

density operator 



E 



<x(i,j)W,j))W,j)\ 



on Ha ® ffs- We shall estimate the distillable entanglement by the proposed 



protocol for the sequence of states {p n = p 



= 1, 



. } , and show the 



distillable entanglement is at least as large as the achievable rate of quantum 
stabilizer codes over the quantum channel T on H with an error X l Z J occurs 
with probability a(i,j). 

The achievable rate by quantum stabilizer codes over T is the maximum of 
a real number R such that for any R' < R and any e > there exists an [[n, k]] 
(k > nR') stabilizer code Q such that any state \<p) G Q can be transmitted 
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over r with fidelity at least 1 — e. 



Proposition 2 We assume that the decoding of a quantum stabilizer code is 
implemented as follows: First measure an observable whose eigenspaces are 
the same as the stabilizer of the code, determine most likely error of the form 
X n Z J1 ® • •• ® X ln Z Jn , and apply the inverse of the guessed error to the code- 
word. Under this assumption, the distillable entanglement by the proposed pro- 
tocol without Step ^ for {p n — p® n : n = 1, . . .} is at least as large as the 
achievable rate by quantum stabilizer codes over T. 

Proof. Let R be the achievable rate by quantum stabilizer codes over T. Then 
for any R' < R and e' > there exists an [[n, k]] (k > nR') quantum stabilizer 
code Q with stabilizer S such that for any state \tp) G Q can be transmitted over 
T with fidelity at least 1 — e'. Let S be generated by {XZ(gi), . . . , XZ(g n _k) 
(and possibly some power of ul) }, and Q belong to the eigenvalue Xi of XZ(g)). 
Suppose that the decoder guesses the error as XZ(e(s)) when the measurement 
outcomes indicate that the received state belongs to eigenvalue XiUj Si of XZ(gi) 
for i = l, . . . , n — k, where s = (s\, . . . , s„_fc). Then the decoder can correct 
any error XZ(u) if 

ue {e(s)+C : se Z^*}, (10) 

where C is a linear subspace of Z^" spanned by g\, . . . , g n -k- 

By Lemma |21 (see Appendix 0, there exists a codeword \<p) € Q such that 
if \<p) is transmitted and XZ(u)\<p) is received with u not in the set 110|) then 
the fidelity between \<p) and the decoded state is at most 9/16, because the 
set (|10|l is equal to the set of correctable errors by Q in Lemma |21 Since \ip) 
can be transmitted through T with fidelity at least 1 — e', the probability of the 
correctable error (|1C)|> over T®" is at least 1 — 16e'/9. 

Suppose that we apply the proposed protocol to p® n such that if the dif- 
ference s of measurement outcomes is observed then XZ(e(s)) _1 is applied in 
Step 01 Then the average © of the fidelity is at least 1 — 16e'/9, because the 
errors in the set (fTUf> are also correctable by the proposed protocol [see Eq. (JB}]. 
For given e > set e' = 9e/16 in the above argument, and we can see that the 
distillable entanglement is at least as large as the achievable rate of quantum 
stabilizer codes over T. ■ 
The best known lower bound on the achievable rate by quantum stabilizer 
codes over T is given by Hamada |S] , and his lower bound gives the true value for 
the depolarizing channels. Let us compare the distillable entanglement by the 
converted protocols and that by the hashing protocol [HJ for the Werner state of 
fidelity F, which is given by a(l, 1) = F, a(0, 1) = a(l, 0) = a(0, 0) = (1 - F)/3 
and p = 2. The Werner state is converted to 

F|/3(0, 0))(/3(0, 0)| + i^ (|/3(0, l))(/3(0, 1)| + 
|/3(1,0))(/3(1,0)| + |/3(1,1))(/3(1,1)|) (11) 
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by applying XZ on Bob's particle. The distillable entanglement of state Ijllfl 
by the hashing protocol is estimated as 



1 - H 2 (F, (1 - F)/3, (1 - F)/3, (1 - F)/3) 



(12) 



where is the Shannon entropy with base b. The distillable entanglement of 
state (|ll[l by the converted protocols is strictly larger than Eq. (|12|l for certain 
range of F, because the achievable rate of the Shor-Smolin concatenated codes 
is strictly larger than Eq. (|12|) over the depolarizing channel of fidelity F [7] and 
they can be written as stabilizer codes 

Let us consider the case of p = 3, a(0,0) = F, and a(i,j) — (1 — F)/8 for 
(hj) 7^ (0) 0)- The distillable entanglement by the nonbinary generalization JU] 
of the hashing protocol is estimated as 



The achievable rate by the quantum stabilizer codes is strictly greater than 
Eq. (E3J for 0.2552 < F < 0.2557 Section VI.C], and so is the distillable 
entanglement by the converted protocols. 

6 Fidelity calculation in general case 

In the preceding argument we assumed that the initial state shared by Alice and 
Bob was in the form of Eq. In this section we remove this restriction. Let 
p be an arbitrary density operator in H® n ® Hg n . We shall consider applying 
the proposed protocol without Step[7|to p and calculate the fidelity between the 
distilled state and |/3(0,0))® fc . Precisely speaking, we shall calculate the fidelity 
between |/?(0, 0)> tS>fc ® |a)® 2 and the state after Step El which is equal to that 
between \/3(0,0))® k and the state after Step© 

The idea of the following argument is borrowed from Section 7.4 of |13| . 
Since there is no selection of particles in Steps^UDby a measurement, the whole 
process of Steps QUID can be written as a completely positive trace-preserving 
map A on the density operators on H® n <g> H^ n . 

Let \ip) g Hf n ®H® n ®H em is a purification of p. Since {\(3{x)) : x € Z 2 p n } 
is an orthonormal basis of H® n ® Hg n , we can write \ip) as 



where |env(x)) is a vector in H onv . 

In StepH the inverse error operator XZ(e) 1 is determined from the differ- 
ence s of measurement outcomes and knowledge of {a(u) ■ u G Z 2 ™}. When 
we deal with an arbitrary but known density operator p, determine e from s 
so that the lower bound l|16fl below on fidelity becomes large. Once we fix a 
determination rule of e from s, we can define Good — {u g Z 2 " : the protocol 



1-H 3 ({a(i,j)}). 



(13) 




(14) 
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can perfectly distill 1/3(0, 0))® fc from \/3(u))}. Equation l|14|) can be written as 
J2 \P(x)) ® |env(f)) + l/3(^)> ® |env(f)). (15) 

:r£Good xGZ^"\Good 

The almost same argument as Section 7.4 of ^3] shows that the fidelity between 
|/3(0, 0))® fe and the state after StepEJis at least 



1 - 



I/TO ® |env(x)) 

SeZ|»\Good 



(16) 
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A Bad codeword lemma 



We consider a quantum channel over which an error of the form XZ(e) occurs 
with the probability a(e) for e S Z^", and we also consider the following decod- 
ing method: Measure the observable of H® n whose eigenspaces are the same 
as those of S, and apply an operator XZ(r e ) (r e 6 Z^™) determined by the 
measurement outcome and some deterministic criterion. With this decoding 
method, we can correct at most p 2n ~ 2k errors among all the p 2n errors for an 
[[n, k]] quantum stabilizer code. 

Lemma 3 Let Q be an [[n, k]] quantum stabilizer code. Suppose that we have a 
fixed decoding method as described above. There exists a codeword \ip) <E Q such 
that 

MXZ(F e )XZ(e)\ V )\ < ~ 

for all uncorrectable error XZ(e), where an error XZ(e) is said to be correctable 
if a received state XZ(e)\ip) is decoded to \ip) for all \ip) € Q and uncorrectable 
otherwise. 



Proof. Consider the following map 
f- 



E Z 2 p n 



w *X Q1 Z bl 8-®r»Z»» .— > (en, ,a n ,b n ) ' 

Let C = f(S) C Zp™. Since S is commutative, we have C C C . Let C max be 
a subspace of Z 2n such that 



x 

C C Cmax C C . 



c — n 



Such a space C max always exists by the Witt theorem (see Sec. 20 of Ref. pQ). 
Since C max = C^ ax , we have dimC max = n. The set / _1 (C max ) is a commu- 
tative subgroup of E, so we can consider a quantum stabilizer code Q m [ n C Q 
defined by /^(CU*). We have dimQ min = p »-dimC max = L Lct |^) e Q min 
be a normalized state vector. We shall construct the desired codeword \ip) in 
Lemma |21 from 

By the property of stabilizer codes, if x + C max ^ y + C max then 

(V>i|XZ(2)*XZ(flhfc)=0. (17) 

Let R C C be a set of coset representatives of C max in C , that is, i? has 
the same number of elements as C ± /C max , and if x, y £ R and x ^ y then 
£ + C max ^ y + C max . We assume e i?. Define 



VP 

which is a normalized state vector in Q by Eq. I|17|) . 



1G 



We want to take \ip) in Lemma|3]as a multiple of \ip\ +1P2}, so let us compute 

(^2) = 4f ^<^|XZ(f)|^) 
VP 

1 



by Eq. |T7|) and G i?. 



By Eq. l(T7|) we also have (V^IV^) = Therefore (tpi + ^{ipi + ip2 

(2 + 2/Vp*)(Vi|^i>- Define |p) by 

1 

#1+^2), 



2 + 2/v^ 

which is a normalized state vector in Q. We shall show that \ip) has the desired 
property. 

Suppose that an error XZ(e') occurred and we applied XZ(fv ) as the recovery 
operator. If e = e' — r e i G C, then the error e' is correctable, otherwise e' is 
uncorrectable. If e ^ C^, the decoded state is orthogonal to any transmitted 
state, so we may assume e G C \ C hereafter. 

For e G C max \ C, 

p k (i/j 2 \XZ(e)\^ 2 ) 
= (Vi|XZ(f)*XZ(e)XZ(y)|^) 

53 (Vi|XZ(f)*XZ(e)XZ(y)|^) by Eq. O 

x+C max ^e+y+C ma x 



= 53(^|XZ(f)*XZ(g)XZ(f)^i) 

xG-R 

= ]T ^< e >^(Vi|xz(f)*xz(f)xz( e oi^i) 

= (^|XZ(e)|Vi>5>< e >r 



xG-R 

Consider the linear map from C to Z p defined by 

) = (e, £ ) . 

Then the kernel of Lg contains C max because e G C max , and e ^ C implies that 
Lg- is not a zero linear map. Hence we can partition R into cosets of ker(Z/g-) in 
C . Each coset of ker(Lg-) in C 1 - contains exactly elements of R, and each 
element in a coset has the same value under Lp. Therefore 



5><*o = x: 

ser sen. 
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i=0 

= 0. 

Summarizing these results we have 

e G C x \ C max =^> (^i|XZ(e)|Vi) = by Eq. CO, 
eGC max \C => (^|XZ(g)|^)=0, 

and by Eq. l(T7|) we have for e G C 1 - 

|<^|XZ(e^ 2 )| = 



Thus we have foreeC 1 \C 



|<V'i+^2|XZ(e)|Vi+^2>| 

< 1 (](VilXZ(e)|^)l + |(^|XZ(e)|^ 2 )| 

2 + 2/y / p k » » ' 

<1 

+ 2|(^|XZ(e)^ 2 )|) 
v v ' 

1 + 



2 + 2/^p k 
< 3/4, 

which completes the proof of Lemma [3] 
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